Skip to main content

Identity Overview

Summary​

HR Suit Identity is an extracted ASP.NET Core service that authenticates platform and tenant users, issues JWTs, manages refresh tokens and device sessions, and stores roles, permissions, login audits, and security events.

Audience​

  • Platform and customer administrators
  • Implementation partners
  • Developers, QA engineers, and DevOps engineers
  • Solution architects and security engineers

Overview​

The extracted identity service is the target authentication boundary for HR Suit. It currently coexists with monolith authentication and user-administration paths while gateway-controlled cutover proceeds incrementally.

Purpose​

The identity boundary provides a consistent authenticated user context for the two HR Suit portals and downstream applications. It separates credentials and access metadata from business-domain data while the wider platform continues its incremental migration from the monolith.

Architecture​

The gateway can route compatible authentication requests to the identity service or the active monolith according to cutover configuration. The identity service uses its own EF Core context and PostgreSQL schema.

Business concepts​

  • Platform account: a user associated with the super-admin portal and no tenant assignment.
  • Tenant account: a client-HRMS user associated with a tenant identity.
  • Portal type: distinguishes platform administration from client-HRMS authentication.
  • Role: a named access grouping assigned to users.
  • Permission: an access key granted through one or more roles.
  • Device session: a server-side record associated with a login and refresh-token activity.
  • Tenant snapshot: identity-owned tenant metadata used to validate tenant context when available.

Technical implementation​

Confirmed components include JWT bearer authentication, BCrypt password verification, role and permission claim creation, refresh-token hashing and rotation, device-session records, login audits, email-verification records, security events, and health/correlation middleware.

The service currently exposes authentication and self-service security endpoints. General user creation, user administration, role administration, profile maintenance, and password-reset operations are not exposed by identity-service endpoints. Related operations remain Transitional in the active monolith or Requires confirmation for their eventual identity-service design.

Confirmed source references​

  • microservices/src/identity-service/Program.cs
  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/identity-service/Data/IdentityDbContext.cs
  • microservices/src/identity-service/Domain/Entities/
  • microservices/src/gateway-api/Program.cs

See Also​

Keywords​

  • Identity ownership
  • Portal identity
  • Identity migration

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: identity-team
  • Status: Draft